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Abstract 

■ We introduce a new class of rate one-half binary codes: complementary information set codes. 

A binary linear code of length 2n and dimension n is called a complementary information set code 
(CIS code for short) if it has two disjoint information sets. This class of codes contains self-dual 
codes as a subclass. It is connected to graph correlation immune Boolean functions of use in the 
security of hardware implementations of cryptographic primitives. Such codes permit to improve the 
cost of masking cryptographic algorithms against side channel attacks. In this paper we investigate this 
new class of codes: we give optimal or best known CIS codes of length < 132. We derive general 
constructions based on cyclic codes and on double circulant codes. We derive a Varshamov-Gilbert 
bound for long CIS codes, and show that they can all be classified in small lengths < 12 by the 
building up construction. Some nonlinear permutations are constructed by using Z 4 -codes, based on 
the notion of dual distance of an unrestricted code. 

O ■ Keywords: cyclic codes, self-dual codes, dual distance, double circulant codes, Z 4 -codes 

^ ; I. Introduction 

Since the seminal work of P. Kocher HT8I . HT9I , it is known that the physical implementation of 
cryptosystems on devices such as smart cards leaks information which can be used in differential 
power analysis or in other kinds of side channel attacks. These attacks can be devastating if 
proper counter-measures are not included in the implementation. A kind of counter-measure, 
which is suitable for both hardware and software cryptographic implementations and does 
not rely on specific hardware properties is the following. It consists in applying a kind of 
secret sharing method, changing the variable representation (say x) into randomized shares 
m 1 ,m 2 , . . . ,m d+1 called masks such that x = mi + m 2 + • • • + m d+1 where + is a group 
operation - in practice, the XOR. Since the difficulty of performing an attack of order d (involving 
d + 1 shares) increases exponentially with d, it was believed until recently that for increasing 
the resistance to attacks, new masks have to be added, thereby increasing the order of the 
countermeasure, see [|25 |. But in these schemes, the profusion of masks implies a heavy load on 
the true random number generator, which significantly degrades the performance of the device. 
Moreover, the solution in ll25l bases itself on a mask refreshing operation for which no secure 
implementation has been detailed so far. Now, it is shown in lETI that another option consists 
in encoding some of the masks, which is much less costly than adding fresh masks. At the 
order 1, this consists in representing x by the ordered pair (F(m),x + m), where F is a well 
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chosen permutation, rather than (m,x + m). The encoding can even be free, in the case it can be 
merged in a single table with the downstream function. Notably, it is demonstrated in E2l . 11231 
that the same effect as adding several masks can be obtained by the encoding of one single mask. 

This method, called leakage squeezing, uses permutations F : F£ — > ¥%, such that, given some 
integer d as large as possible, for every pair of vectors a, b E such that the concatenated vector 
(a, b) is nonzero and has Hamming weight < d, the value of the Walsh-Hadamard transform of F 
at (a, b), is null. We call such functions d-GCI, for Graph Correlation Immune of order d since 
the condition is equivalent to saying that the indicator function of the graph {(x, F(x)); x E FJ?} 
is correlation immune of order d—1 [5]. Thus a d-GCl function is a protection against an attack 
of order d—1. These functions were introduced in [22] where it is proved that the existence of 
such Boolean functions when they are linear is equivalent to the existence of binary linear codes 
with parameters [2n, n, > d] having two disjoint information sets. Based on this equivalence we 
say that a binary linear code of length 2n and dimension n is Complementary Information 
Set (CIS for short) with a partition L, R if there is an information set L whose complement 
R is also an information set. In general, we will call the partition written in pidgin Maple as 
[l..n], [n+1..2n] the systematic partition. More explicitly, we describe CIS codes with relation 
to permutations as follows. 

Assuming a systematic possibly nonlinear code C of length 2n of the form 

C = {(x,F(x))\xE¥^}, 

the permutation is constructed as the map x F(x). In that setting C is CIS by definition if and 
only if F is a bijection. When C is a linear code, we can also consider a systematic generator 
matrix (I, A) of the code, where I is the identity matrix of order n and A is a square matrix 
of order n. Then F(x) = xA, and the CIS condition reduces to the fact that A is nonsingular. 

On the other hand, since the complement of an information set of a [2n, n] linear code is an 
information set for its dual code, it is clear that systematic self-dual codes are CIS with the 
systematic partition. It is also clear that the dual of a CIS code is CIS. Hence CIS codes are a 
natural generalization of self-dual codes. 

In the present work we give explicit constructions of optimal CIS codes of length < 132, and 
derive a Varshamov-Gilbert bound for long CIS codes^. We give general constructions based 
on cyclic codes and double circulant codes. We show that all CIS codes of length < 12 can 
be classified by the building up construction, an important classification tool for self-dual codes 
[16]. We go back to the notion of graph correlation immune function, and based on the notion 
of dual distance we give a class of unrestricted codes giving Boolean functions with immunity 
of higher degree than the functions in the same number of variables obtained from linear CIS 
codes (the practical performance of non linear bijections is explored in the companion paper 
[23] ). In particular the best codes we obtain in that way are binary images of certain Z 4 -codes, 
the quadratic residue codes [2J. Notice moreover that the notion of being CIS is not trivial since 
there exists at least one optimal code (a [34, 17, 8] code) which is not CIS. 

The material is organized as follows. Section 2 collects the necessary notation and definitions. 
Section 3 extends the notion of CIS codes to possibly nonlinear codes. Section 4 contains the 
general constructions of CIS codes using cyclic codes and double circulant codes. Section 5 

'While in cryptographic practice n is not so large, the coding problem is of sufficient intrinsic interest to motivate the study 
of long codes. 
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describes the known optimal linear CIS codes of length < 132. Section 6 is dedicated to the 
building up construction and gives a classification of CIS codes of length < 12. Section 7 derives 
a VG bound on long linear CIS codes without relying on previous knowledge on the asymptotic 
performance of self-dual codes. All our computations were done using Magma ll26ll . 

II. Notation and definitions 

A. Binary codes 

Let C be a binary linear code. Its parameters are formatted as [n, k, d] denoting length, 
dimension, and minimum distance. By an unrestricted code we shall mean a possibly nonlinear 
code. The dual C 1 - of a linear code C is understood to be with respect to the standard inner 
product. The code C is self-dual if C — C 1 and isodual if C is equivalent to C^. A self-dual 
code is Type II if the weight of each codeword is a multiple of four and Type I otherwise. 
A binary (unrestricted) code C of length n is called systematic if there exists a subset I of 
{1, • • • ,n} called an information set of C, such that every possible tuple of length |/| occurs 
in exactly one codeword within the specified coordinates x^; i E I. We call CIS (unrestricted) 
code a systematic code which admits two complementary information sets. The Hamming 
weight w(z) of a binary vector z is the number of its nonzero entries. The weight enumerator 
Wc(x,y) of a code C is the homogeneous polynomial defined by 

W c (x,y) = J2x n ~ w{c) y w{c) - 

c£C 

The code C is formally self -dual or fsd 

the MacWilliams transform, that is, 

W c (x,y) 

It is furthermore called even if 

W c (x,-y) = W c (x,y), 

and odd otherwise. The generator matrix of a [2n, n] code is said to be in systematic form if 
it is blocked as (/, A) with / the identity matrix of order n. If A is circulant then C is said to 
be double circulant. 

B. Boolean functions 

A permutation F of F£ is any bijective map from F2 — » Its Walsh-Hadamard transform 
at (a, b) is defined as 

F(a,b) = J2(-l) a ' x+b ' F(x) , 
where a ■ x denotes the scalar product of vectors a and x. 



for short, if its weight enumerator is invariant under 

,x + y x — y 
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C. Dual distance 

If C is a binary code, let 5, denote its distance distribution, that is, 

Bi = j^r|{(ar,y) G C x C | d(x,y) = i}\ 

The dual distance distribution is the Mac Williams transform of the distance distribution, in 
the sense that 

where 

n 

D c {x,y) = Y d B i x n - i y i , 

i=0 

and 

n 
i=0 

The dual distance of C is the smallest i > such that 7^ 0. When C is linear, it is the 
minimum distance of C L , since Dq(x, y) = D c ±(x,y). 

For u G Fg, define the character attached to u evaluated in C as 

xu(c) = ■ 

Z). Z4-coJe5 

Recall that the Gray map from Z 4 to F2 is defined by 

0(0) = 00,0(1) = 01,0(2) = 11,0(3) = 10. 

This map is extended componentwise from to F| n . A Z 4 -code of length n is a Z 4 -submodule 
of Z 4 . The binary image 0(C) of a Z 4 -code C is just {0(c) | c G C}. In general a Z 4 -code C 
is of type 4 fc 2' if C ~ Z 4 Z^ as additive groups. A Z 4 -code is called free if / = 0. An important 
class of Z 4 -codes is that of QR(p + 1) where QR stands for Quadratic Residue codes and p 
is a prime congruent to ±1 modulo 8. They were introduced as extended cyclic codes in [0, 
based on Hensel lifting of classical binary quadratic residue codes EOl . 

III. Generalization to non-linear codes 

Recall that in the context of ll22ll . Il2~3l we need to use Boolean permutations - more precisely, 
permutations F : F2 — y Fg, such that, given some integer d as large as possible, for every pair 
of vectors a, b G F!? such that the concatenated (a, b) is nonzero and has Hamming weight < d, 
the value of the Walsh-Hadamard transform of F at (a, b), is null. Such Boolean functions are 
called d-GCI, for Graph Correlation Immune. 

In ll23l the following proposition is proven: 

Proposition III.l. The existence of a linear d-GCI function of n variables is equivalent to the 
existence of a CIS code of parameters [2n,n, > d] with the systematic partition. 
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To generalize this result to systematic, possibly nonlinear codes, we attach to such a vectorial 
function F the code Cp defined by the relationship 

C F = {(x,F(x))\xE¥^}. 

Theorem III.2. The permutation F : F 2 — > F 2 is a d-GCI function of n variables if and only 
if the code Cp has dual distance > d. 

Proof. The proof follows immediately by the characterization of the dual distance of a code C 
in terms of characters Xu(C) of C regarded as an element in the group algebra Q[F 2 ] (201 Chap. 
5, Theorem 7]. Essentially, this characterization says that d 1 - is the smallest non zero weight of 
a vector u E F 2 such that Xu{C) ^ 0. Note that the value of the Walsh-Hadamard transform of 
F at (a, b) is Xu(C) for u = (a, b) and C = C F . ■ 

Since the dual of a CIS code is also CIS, Proposition IIII. 1 1 follows at once from Theorem IIII.2I 
This theorem also allows us to construct better GCI functions by using nonlinear codes. Define 
a free Z 4 -code of length n with 2" codewords to be CIS if it contains two disjoint information 
sets. 

Theorem III.3. If C is a free systematic Z^-code of length n with 2 n codewords, then its binary 
image is a systematic code of the form Cp for some F. Furthermore, C is CIS with systematic 
partition if and only if F is one-to-one. 

Proof. By hypothesis the generator matrix of C is of the shape (I, A) and therefore any codeword 
of C can be cast as (x, F(x)) for some Z 4 linear map F from Z4 to Z™ . The result follows by 
taking the binary image of each codeword. The CIS property entails that F is bijective, and, 
consequently, so is F. Conversely, if F is bijective then [n + 1..2n] is an information set. ■ 

Example III.4. Consider the Nordstrom Robinson code in length 16. It is the image of the 
octacode |fT2|. which is free and CIS since it is self-dual. It therefore satisfies the hypothesis of 
Theorem IIII.3I and therefore can be attached to a 6-GCI function in 8 variables, when the best 
linear CIS code only gives a 5-GCI function as shown in the next section. 

Example III.5. Consider QR32 a self-dual extended cyclic Z 4 -code J3). Its binary image of 
length 64 has distance 14, which is better than the best known [64, 32] binary code of distance 
12. Similarly, QRA8 has a binary image of distance 18 Q, when the best binary rate one-half 
code of length 96 has distance 16. 

Example III.6. Recently, Kiermaier and Wassermann lfi~5l have computed the Lee weight 
enumerator of the type II Z 4 -code QR80 and its minimum Lee weight dp = 26. Hence its 
binary image has distance 26, which is better than the best known [160, 80] binary code of 
distance 24. 

IV. General constructions for CIS codes 

We now consider general constructions for the class of CIS codes. The following two lemmas 
are, respectively, immediate and well-known. 

Lemma IV. 1. If a [2n,n] code C has generator matrix (I, A) with A invertible then C is CIS 
with the systematic partition. Conversely, every CIS code is equivalent to a code with a generator 
matrix in that form. 
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In particular this lemma applies to systematic self-dual codes whose generator matrix (J, A) 
satisfies AA T = I. In the following two results, we identify circulant matrices with the polyno- 
mial in x whose x— expansion coincides with the first row of the matrix. 

Lemma IV.2. Let f(x) be a polynomial over F 2 of degree less than n. Then, gcd(/(x), x n — 1) = 
1 if and only if the circulant matrix generated by f(x) has ¥ 2 -rank n. 

Proposition IV.3. The double circulant code whose generator matrix is represented by (1, f(x)) 
satisfying Lemma \IV.2\ is a CIS code. 

Proof. Combine Lemma IIV.1I with Lemma IIV.21 ■ 

In the other direction, a partial converse to Lemma HV.ll is the following. 

Proposition IV.4. If a [2n,n] code C has generator matrix {I, A) with rk(A) < n/2 then C is 
not CIS . 

Proof. Let L = [l..n], and R = [n + 1..2n]. If / is an information set, by the rank hypothesis, 
then |/fl-R| < n /2 and, consequently, |/fl-^l > n /2- So two distinct information sets must 
intersect non trivially in L. m 

The next proposition is an immediate but useful observation. 

Proposition IV.5. If C is a [2n, n] code whose dual has minimum weight 1 then C is not CIS. 

Proof. If the dual of C has minimum weight 1 then the code C has a zero column and therefore 
cannot be CIS. ■ 

The previous proposition permits to show it is possible for an optimal code not to be CIS: 

Proposition IV.6. There exists at least one optimal binary code that is not CIS. 

Proof. The [34,17,8] code described in the Magma package BKLC(GF(2), 34, 17)) (best 
known linear code of length 34 and dimension 17) is an optimal code (minimum weight 8 
is the best possible minimum distance for such a code) whose dual has minimum distance 1, 
and therefore is not CIS. ■ 

A special class of CIS codes is obtained from combinatorial matrices O. Let A be an integral 
matrix with 0/1 valued entries. We shall say that A is the adjacency matrix of a strongly regular 
graph (SRG) of parameters (n, k, A, /i) if A is symmetric, of order n, verifies AJ = J A = kJ 
and satisfies 

A 2 = kI + XA + n{J - I - A), 

where I, J are the identity and all-one matrices of order n. Alternatively we shall say that A 
is the adjacency matrix of a doubly regular tournament (DRT) of parameters (n, k, A, /i) if A 

is skew-symmetric, of order n, verifies AJ = J A = kJ and satisfies 

A 2 = XA + n(J - I — A). 
In the next result we identify A with its reduction mod 2. 

Proposition IV.7. Let C be the linear binary code of length 2n spanned by the rows of (I, M). 
With the above notation, C is CIS if A is the adjacency matrix of a 

• SRG of odd order with k, A both even and fi odd and if M = A + I 

• DRT of odd order with k, fi odd and A even and if M = A 
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• SRG of odd order with k even and A, fi both odd and if M = A + J 

• DRT of odd order with k even and A, \i both odd and if M = A + J 

Proof. In the first case, reduce the quadratic matrix equation modulo 2 to obtain 

A 2 = J + I + A. 

If x E F£ is non trivial in Ker(A + I), then the above equation written as A(A + I) = J + I, 
entails Jx = x which implies, by studying the eigenspaces of J that x is the all one vector 1. 
But because k is even we know that Al = 0. This is a contradiction. So, Ker(M) is trivial and 
the result follows by Lemma HV. 1 1 The proof in the second case is analogous. In the third case 
the matrix equation becomes 

A 2 = J + I. 

If x E Ker(M) then x E Ker(M 2 ), but, by the hypotheses on k and n, we see that M 2 = 
A 2 + J = I, yielding x = 0. The proof of the fourth case is analogous to that of the third case. 
■ 

Let q be an odd prime power. Let Q be the q by q matrix with zero diagonal and q^ = 1 if 
j — i is a square in GF(q) and zero otherwise. 

Corollary IV.8. If q = 8j + 5 then the span of (I, Q + I) is CIS. If q = 8 j + 3 then the span 
of (J, Q) is CIS. 

Proof. It is well-known [6] that q = Ak + 1 then Q is the adjacency matrix of a SRG with 
parameters [q, 2=£ ( ^r-). If q = Ak + 3 then Q is the adjacency matrix of a DRT with 
parameters (q, 2=-, 2 r^). The result follows by Proposition IIV.7I ■ 

The codes obtained in that way are Quadratic Double Circulant codes jH. The third and 
fourth cases of Prop IIV.7I cannot apply to either Paley SRG or DRT since for these we have 
H — A = 1. 

Example IV.9. Let A be the adjacency matrix of an SRG of parameters (57,24, 11,9), which 
exists by Brouwer's database H|. By the third case of Proposition IIV.7I we get a CIS code of 
length 114. 

Now we look at CIS codes constructed from cyclic codes. Denote by Cj the code C shortened 
at coordinate i and by C the extension of C by an overall parity check. 

Proposition IV. 10. Let C be a cyclic binary code of odd length N, and dimension ^y^. If its 
generator matrix is in circulant form, both C\ and Cn are CIS with the systematic partition. If 
furthermore, the weight of the generator polynomial is odd, then C is CIS with the systematic 
partition. 

Proof. Recall that in a cyclic code of dimension k, consecutive k indices form an information 
set. The result follows then for C\ and CV In the extended case, the generator matrix of C is 
obtained from that of C by inserting a column of l's in position ^y^. It consists then of two 
juxtaposed upper triangular and lower triangular, non singular matrices. ■ 

V. CIS CODES WITH RECORD DISTANCES 

In this section, we construct optimal or best-known CIS codes of length 2n < 130. We 
refer to lfi~4ll for the highest known minimum distances of rate one-half codes for lengths up 
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to 48. In the rest of the section we list what we know of CIS codes of length < 130. All 
statements referring to best rate one-half codes of lengths > 48 come from [28|. All statements 
on existence of self-dual codes are from either or ifTOl . We could have used [fTTI . The 
command BKLC(GF(2),n, k) from the computer package Magma ll2~6ll means the best known 
binary linear [n, k] code as per [28l . We put a * as an exponent of a distance if the CIS code 
is optimal as a rate one-half code. The table captions are as follows 

• bk= obtained the command BKLC(GF(2), n, k) from Magma. 

• dc=double circulant 

• fsd=formally self-dual 

• id=isodual 

• nsd= not self-dual 

• nfsd= not formally self-dual 

• qdc=quadratic double circulant 

• sc=special construction 

• sd= self-dual 

• sqr=shortened quadratic residue code 

• xqdc=extended quadratic double circulant 

• xqr=extended quadratic residue code 



A. Lengths 2 to 32 



2n 


2 


4 


6 


8 


10 


12 


14 


16 


18 


20 


22 


24 


26 


28 


30 


32 


d 


2* 


2* 


3* 


4* 


4* 


4* 


4* 


5* 


6* 


6* 


7* 


8* 


7* 


8* 


8* 


8* 


code 


dc 


dc 


~dc 


sd 


dc 


sd 


sd 


~dc 


~dc 


nfsd 


id 


sd 


fsd 


dc 


dc 


sd 



• 2n = 2, 4. Double circulant codes of length 2n = 2, 4 with first rows 1 or 10, respectively, 
are optimal CIS codes with minimum distance 2. They are in fact self-dual. 

• 2n = 6. Lemma llV.21 does not imply that double circulant codes of this length with d = 3 
are CIS codes. However, the equivalent code {(100 011), (010 101), (001 111)} can be 
checked to be an optimal CIS code with d = 3. 

• 2n = 8. The extended Hamming [8,4,4] code is an optimal CIS code. 

• 2n = 10. The double circulant with first row 0111 in [fl~4l is an optimal CIS code with 
d = 4 by Lemma lTV.21 

• 2n = 12. There exists a self-dual [12,6,4] code, which is an optimal CIS code. 

• 2n = 14. There exists a self-dual [14, 7, 4] code, which is an optimal CIS code. 

• 2n = 16. There is a unique optimal [16, 8, 5] code lfl4l . which is also odd formally self- 
dual. This is a double circulant code with first row 00010111. It cannot be a CIS code with 
systematic partition by Lemma IIV.21 We need a new representation of this code. Take C*i 6 
as BKLC(GF(2), 16,8) in Magma. We check that C w is also an odd formally self-dual 
[16, 8, 5] code. The determinant of the right half submatrix of the standard generator matrix 
of Ci6 is 1. Hence C\$ is an optimal CIS code. 

• 2n = 18. There is a unique optimal [18, 9, 6] code lfi~4l . which is also odd formally self- 
dual. It is described as a double circulant code with first row 001001111. The corresponding 
polynomial x 6 + x 3 + x 2 + x + 1 is factored as (x 2 + x + l)(x 4 + x 3 + 1). As x 9 + 1 has 
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a factor x 3 + 1 = (x + l)(x 2 + x + 1), this code cannot be proved to be CIS by Lemma 
IIV.21 On the other hand, we take C 18 as BKLC(GF(2), 18, 9) in Magma, which is also a 
[18, 9, 6] code. The determinant of the right half submatrix of the standard generator matrix 
of Cis is 1. Hence Ci 8 is an optimal CIS code. 

• 2n = 20. There are 1682 optimal [20, 10, 6] codes |fl4|. There are exactly eight formally 
self-dual codes among them |fl4|. We obtain the first non-formally self-dual optimal CIS 
code by taking BKLC(GF(2), 20, 10) in Magma notation with the systematic partition. 

. 2n = 22. We take BKLC(GF(2), 20, 10) in Magma notation with the systematic partition. 
This code is isodual and fsd. 

• 2n = 24. The extended Golay code is CIS as a self-dual code. It is also optimal as a rate 
one-half code. 

» 2n = 26. The fsd isodual code Ci§,\ in the notation of [14J is CIS with the systematic 
partition. 

. 2n = 28. The even fsd BKLC(GF(2), 20, 10) is not self-dual but still CIS with the 
sytematic partition by Lemma IIV. 1 1 

• 2n — 30. We use a double circulant code with generator matrix (1, /) where / = x 10 + 
x 8 + x 7 + x 5 + x 3 + x + 1, an irreducible polynomial. This code is CIS with the systematic 
partition by Proposition IIV. 3 1 

• 2n = 32. There are five extremal Type II [32, 16, 8] self-dual codes. They are also optimal 
as rate one-half codes. 



B. Lengths 34 to 64 



2n 


34 


36 


38 


40 


42 


44 


46 


48 


50 


52 


54 


56 


58 


60 


62 


64 


d 


8* 


8* 


8 


9 


10* 


10* 


11* 


12* 


10 


10 


12 


12 


12 


12 


12 


12 


code 


sc 


sd 


sd 


nsd 


fsd 


fsd 


fsd 


sd 


sd 


sd 


bk 


sd 


qdc 


sd 


sd 


sd 



2n = 34. We have checked that BKLC(GF(2), 34, 17) of distance 8 is not CIS with 
systematic partition. There are s-extremal self-dual [34,17,6] codes (see [1]). Taking the 
doubly-even subcode of such a code and adding an element of the shadow we obtain a 
[34, 17, 8] code with generator matrix (I, A) with A given by 



1 

1 1 
1 1 
1 1 





1 



1 1 





1 
1 





1 











1 

V o o o i 




10 1 

111 



1 







1 

111 


1 
10 

111 

10 
110 
10 
110 
10 1 
10 
10 1 
1 

111 

10 

1 1 











1 1 
1 1 
1 





1 

1 

1 1 
1 



1 
1 
1 



1 
1 



1 



1 

1 

1 

1 1 



1 

1 1 



1 





111 
111 



1 

1 

1 1 





1 
1 



1 
1 
1 
1 
1 

1 1 



1 1 



1 1 
1 1 



1 1 

1 



1 

1 1 



1 

1 

1 

1 





1 
1 
1 
1 
1 
1 
1 



1 





Then it can be checked that this code is CIS with partition L = {14, ... , 30} and R = 

{1,..., 13,31,. ..,34}. 

2n = 36. There are many self-dual Type I [36, 18, 8] self-dual codes. They are also optimal 
as rate one-half codes. 
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• 2n = 38. There are many self-dual Type I [38, 19, 8] self-dual codes. They are the best 
known rate one-half codes of that length. 

. 2n = 40. There is an odd fsd isodual BKLC(GF(2), 40, 20) of distance 9, the best known 

rate one-half code of that length. It is CIS by computer check of Lemma HV.ll 
. 2n = 42. There is an even fsd isodual BKLC(GF(2), 42, 21) of distance 10, an optimal 

rate one-half code of that length. It is CIS by computer check of Lemma HV.ll 
. 2n = 44. There is an odd fsd isodual BKLC(GF(2),U,22) of distanc e 10, an optimal 

rate one-half code of that length. It is CIS by computer check of Lemma HV.ll 
. 2n = 46. There is an odd fsd isodual BKLC(GF(2), 46, 23) of distance 11, an optimal 

rate one-half code of that length. It is CIS by computer check of Lemma IIV.ll 

• 2n = 48. There is a unique Type II [48, 24, 12] code, an optimal rate one-half code of that 
length. 

• 2n = 50. There are at least 6 Type I self-dual codes of distance 10, which is best known 
as per 11281 . 

» 2n = 52. There are at least 499 Type I self-dual codes of distance 10, which is best known 
as per & 

. 2n = 54. The code BKLC(GF(2), 54, 27) has distance 11. Computing a determinant 
shows that it is CIS with the systematic partition. 

• 2n = 56. There are Type II self-dual codes of distance 12, which is the best known distance 
for rate one-half codes of that length. 

» 2n = 58. The Quadratic Double Circulant attached to the prime 29 has distance 12 and is 
CIS with the systematic partition by determinant computation. 

• 2n = 60. There are at least 15 Type I self-dual codes of distance 12, the best known 
distance for rate one-half codes of that length. 

• 2n = 62. There are at least 20 Type I self-dual codes of distance 12, the best known 
distance for rate one-half codes of that length. 

• 2n — 64. There are at least 3270 Type II self-dual codes of distance 12, the best known 
distance for rate one-half codes of that length. 

C. Lengths 66 to 100 



2n 


66 


68 


70 


72 


74 


76 


78 


80 


82 


84 


86 


88 


90 


92 


94 


96 


98 


100 


d 


12 


13 


15 


15 


14 


14 


15 


16 


14 


15 


16 


17 


18 


16 


16 


16 


17 


18 


code 


sd 


bk 


bk 


bk 


xqr 


sd 


bk 


sd 


sd 


bk 


sd 


sqr 


bk 


sd 


sd 


sd 


bk 


sc 



• 2n = 66. There are at least 3 Type I self-dual codes of distance 12, the best known distance 

for rate one-half codes of that length. 
. 2n = 68. The code BKLC{GF(2), 68, 34) of distance 13 is CIS with the systematic 

partition, by determinant computation. 
. 2n = 70. The code BKLC(GF(2), 70, 35) of distance 15 is CIS with the systematic 

partition, by determinant computation. 
. 2n = 72. The code BKLC(GF(2), 72, 36) of distance 15 is CIS with the systematic 

partition, by determinant computation. 
. 2n = 74. Is BKLC(GF '(2), 74, 37) of distance 14 CIS? The extended quadratic residue 

code [74,37, 14] is CIS with the systematic partition by Proposition IIV. 1 01 
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• 2n = 76. There are at least 2 Type I self-dual codes of distance 14, the best known distance 
for rate one-half codes of that length. 

• 2n = 78. A shortened code of quadratic residue code [79, 40, 15] leads to a [78, 39, 14] CIS 
code with the systematic partition, by Proposition IIV.10I 

• 2n = 80. There are at least 15 Type II self-dual codes of distance 16, the best known 
distance for rate one-half codes of that length. 

• 2n = 82. There is at least 1 Type I self-dual code of distance 14, the best known distance 
for rate one-half codes of that length. 

. 2n = 84. The code BKLC(GF(2),M,42) of distance 15 is CIS with the systematic 
partition, by determinant computation. 

• 2n = 86. There is at least 1 Type I self-dual code of distance 16, the best known distance 
for rate one-half codes of that length. 

• 2n = 88. A shortened code of the quadratic residue code [89,45, 17] leads to a [88,44, 17] 
CIS code with the systematic partition, by Proposition HV.101 

. 2n = 90. The code BKLC(GF(2), 88, 44) of distance 18 is CIS with the systematic 
partition, by determinant computation. 

• 2n = 92. There are at least 1 Type I self-dual code of distance 16, the best known distance 
for rate one-half codes of that length. 

• 2n = 94. There is at least 1 Type I self-dual code of distance 16, the best known distance 
for rate one-half codes of that length [[TBI . 

• 2n = 96. There is at least 1 Type I self-dual code of distance 16, the best known distance 
for rate one-half codes of that length. 

. 2n = 98. The code BKLC(GF(2), 98, 49) of distance 17 is CIS with the systematic 
partition, by determinant computation. 

. 2n = 100. The code BKLC(GF(2), 100, 50) of distance 18 is CIS with the systematic 
partition, since it is obtained by puncturing and double shortening from a Quadratic Residue 
code of length 103 [28]. The argument is similar to Proposition HV.101 

D. Lengths 102 to 130 



2n 


102 


104 


106 


108 


110 


112 


114 


116 


118 


120 


122 


124 


126 


128 


130 


d 


19 


20 


19 


20 


18 


19 


20 


20 


20 


20 


20 


21 


21 


22 


22 


code 


bk 


bk 


qdc 


bk 


bk 


bk 


bk 


sc 


sc 


sd 


qdc 


xqdc 


bk 


bk 


sc 



. 2n = 102. The code BKLC(GF(2), 102, 51) of distance 19 is CIS with the systematic 

partition, by determinant computation. 
. 2n = 104. The code BKLC(GF(2), 104, 52) of distance 20 is CIS with the systematic 

partition, by determinant computation. 
. 2n = 106. The code BKLC(GF(2), 106, 53) of distance 19 is CIS by computer search. 
. 2n = 108. The code BKLC(GF(2), 108, 54) of distance 20 is CIS with the systematic 

partition, by determinant computation. 
. 2n = 110. The code BKLC{GF(2), 110, 55) of distance 18 is CIS with the systematic 

partition, by determinant computation. 
. 2n = 112. The code BKLC(GF(2), 112, 56) of distance 19 is CIS with the systematic 

partition, by determinant computation. 
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. 2n = 114. The code BKLC(GF(2), 114, 57) of distance 20 is CIS with the systematic 
partition, by determinant computation. 

. 2n = 116. The code BKLC(GF(2), 116, 58) is not CIS by Prop EH since its dual has 
minimum weight 1. A CIS code can be obtained in the following way: consider g(x) the 
generator polynomial of the [127, 71, 19] BCH code of length 127 with designed distance 
19. Consider a generator matrix Go of the code obtained by shifting the coefficients of 
g(x) in the usual way. Consider now the matrices G\ and C7 2 obtained by shifting Gq of 
respectively 1 and 2 positions. We now construct the matrix G' = Go + G\ + G 2 . We then 
add to G' a last column of l's and we erase the first row to obtain a matrix G. The matrix 
G generates a [128, 70, 20] code C. Now if one shortens C on the first twelve columns, 
one obtains a [116, 58, 20] code which is CIS with the systematic partition. 

. 2n = 118. The code BKLC(GF(2), 118, 59) is not CIS by Prop |lV5l since its dual 
has minimum weight 1. Similarly to the case 2n = 116, a CIS code can be obtained in 
the following way: consider g(x) the generator polynomial of the BCH code of length 
127 and designed distance 19. Consider a generator matrix Gq of the code obtained by 
shifting the coefficients of g(x) in the usual way. Consider now the matrices G\ and C7 2 
obtained by shifting G of respectively 1 and 2 positions. We now construct the matrix 
G' = Go + G\ + (j2- We then add to G' a last column of 1 and we erase the first two 
rows to obtain a matrix G. The matrix G generates a [128, 69, 20] code C. Now if one 
shortens the first ten columns of C, one obtains a [118, 59, 20] code which is CIS with the 
systematic partition. 

• 2n = 120. There is at least 1 Type II self-dual code of distance 20, the best known distance 

for rate one-half codes of that length. 
. 2n = 122. Is BKLC(GF(2), 122, 61) of distance 20 CIS? The code QDC{Q1) of distance 

20 is CIS with the systematic partition, by determinant computation. 
. 2n = 124. Is BKLC(GF(2), 124, 62) of distance 20 CIS? The code 

ExtendCode(BorderedDoublyCirculantQRC ode (6 1) ) 

of distance 20 is CIS with the systematic partition, by determinant computation. 
. 2n = 126. The code BKLC{GF(2), 126, 63) of distance 21 is CIS with the systematic 

partition, by determinant computation. 
. 2n = 128. The code BKLC(GF(2), 128, 64) of distance 22 is CIS with the systematic 

partition, by determinant computation. 
. 2n = 130. The code BKLC(GF(2), 130, 65) of distance 22 is CIS by computer search. 

VI. Classification 

A. Number of equivalence classes of CIS codes 

Let n > 2 be an integer and g n denote the cardinality of GL(n, 2) the general linear group 
of dimension n over GF(2). It is well-known (see [|20i p.399]), that 

n-1 

g n = l[(2 n -y). 

3=0 

Proposition VI. 1. The number e n of equivalence classes of CIS codes of dimension n > 2 is 
at most g n /n\. 
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Proof. By Lemma |IV. 1 1 every CIS code of dimension n is equivalent to the linear span of (J, A) 
for some A e GL(n, 2). But the columns of such an A are pairwise linearly independent, hence 
pairwise distinct. Permuting the columns of A leads to equivalent codes. ■ 

Example VI.2. There is a unique CIS code in length 2 namely R 2 the repetition code of length 2. 
For n = 2, the g 2 = 6 invertible matrices reduce to three under column permutation: the identity 

' 1 1 \ , m I 1 ' 



matrix 7 and the two triangular matrices 7\ = I ^ J ' anC * ^ 2 = I 1 1 J ' ^ £ S enera ^ or 
matrix (I, I) spans the direct sum R 2 @ R 2) while the two codes spanned by (J, T{) and (J, T 2 ) 
are equivalent to a code C3, an isodual code which is not self-dual. Thus e 2 = 2 < #2/2! = 3. 

The numbers g n /n\ grow very fast: 3, 28, 840, 83328. They count the number of bases of 
F2 over F 2 11271 A053601]. The numbers e n do not grow so fast as can be seen by looking at 
Table I. 



B. Building up construction 

The building up construction lfi~6l is known for binary self-dual codes. In this section, we 
extend it to CIS codes. We show that every CIS code can be constructed in this way. 

Lemma VI.3. Given a [2n, n] CIS code C with generator matrix (I n \A) where A is an invertible 
square matrix of order n, we can obtain a [2{n — 1), n — 1] CIS code C with generator matrix 
(I n -i\A'), where A' is an invertible square matrix of order n — 1. 

Proof. Let a* be the ith column of A and be the ith row of A for 1 < i < n. We delete the 
first column a\. Then for each i, let r[ be the ith row obtained from r, after the removal of the 
first coordinate of r^. Since there are n rows r\ in the (n — 1) -dimensional space, there is j such 
that r'j = Yli^j c i r 'i> where q is uniquely determined. Then delete the jth row of (I n \A) and the 
jth column of (I n \A) to get a [2(n — l),n— 1] CIS code C with generator matrix (I n _i\A'), 
where A' is invertible. We remark that A' is a square matrix of order n — 1 whose rows consist 
of the n — 1 r-s except for r'- and whose columns consist of a[s (2 < i < n), each of which is 
the ith column obtained from a; t after the removal of the jth component of aj. ■ 

Proposition VI.4 (Building up construction). Suppose that C is a [2n, n] CIS code C with 
generator matrix (I n \A), where A is invertible with n rows r 1; . . . , r n . Then for any two vectors 
x = (xx, • • • , x n ) and y = (yi, • • • , y n ) T the following matrix G\ generates a [2(n + l),n+ 1] 
CIS code C\ with the systematic partition: 





( 1 





•■ 


• 




X 


\ 







1 


•■ 


• 


yi 


T\ 




G x = 








1 • ■ 


• 


V2 


r 2 






U 





•■ 


• 1 


Vn 


r n 


J 



where there are multipliers Ci's satisfying x = Y^=i c i r i an d %x — 1 + Y^i=i c iVi- 

Proof. It suffices to show that the rows of the right half of G\ are linearly independent. Suppose 

a(zx\x) + /3x{yi\rx) H h f3„(y n \r n ) = 0. Then ax + Yn=i Pi r i = 0. If a = 0, then = for 

all i as it should. If a — 1, then x + YH=i Pi r i = 0- Since x = XT=i c * r * f° r un iq ue c i' s > we 
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have 0i = c { for all i. Thus = z 1 + Ya=\ c iVi = 1 + Yn=i c iVi + Yh=i c iVi = a contradiction. 
Thus the rows of the right half of G" are linearly independent ■ 

Example VI.5. Let us consider a [6, 3, 3] CIS code C whose generator matrix is given below. 














1 




(i 


1 





1 





!) 







1 


1 


1 





In order to apply Proposition IVI.41 we take for example x = (1, 1, 0) and y — (1, 1, 0) T . Then 
Ci = c 2 = l,c 3 = 0. Hence z = 1. In fact, we get the extended Hamming [8,4,4] code whose 
generator matrix is given below. 



/ 1 











1 


1 


1 


o\ 





1 








1 





1 


1 








1 





1 


1 





1 


v° 








1 





1 


1 





Furthermore, starting from G\, we can obtain G back by following the proof of Lemma fVI3l 

Proposition VI.6. Any [2n, n] CIS code C is equivalent to a [2n, n] CIS code with the systematic 
partition which is constructed from a [2(n — 1), n — 1] CIS code by using Proposition \VI.4\ 

Proof. Up to permutation equivalence, we may assume that C is a [2n, n] CIS code with 
systematic generator matrix G 2 = (I n \A), where A is invertible. For each i (1 < i < n), 
we let a,i be the ith column of A and r { be the ith row of A. It suffices to show that there exists 
a 2{n — 1) x (n — 1) systematic generator matrix (J n _ 1 |A / ) with A' being invertible, whose 
extension by Proposition IVI.41 produces the matrix (I n \A) back. We know from Lemma IVI.3I 
that there exists a [2(n — l),n — 1] CIS code C' with systematic generator matrix (I n _i\A'), 
where A' is invertible. By the remark at the end of the proof of Lemma IVI.31 A' is a square 
matrix of order n — 1 whose rows consist of the n — 1 r • s except for r'j and whose columns 
consist of a- s (2 < i < n), each of which is the ith column obtained from <2j after the removal 
of the jth component of a^. We denote the first column a x of A by a x = (a{, a*, . . . , a{, . . . , a") T 
and a[ by the column from a\ after the removal of the jth component of a%. We choose y = a[ 
and x = r'j. Then it follows from Proposition IVI.41 that the below generator matrix generates a 
[2n, n] CIS code. 





/ 1 





•• 


• 






\ 








1 




■• 

1 ■ ■ 


■ 
• 


a{ 
a\ 


r' 2 






u 





•■ 


■ 1 




r' 

n 


) 



where z± = l + J2i^j °i a \ m ^ r 'j = c * r i f° r some c *' s - We claim that this z\ is equal to the 
missing component a{ of a[. Suppose not. Then a{ = c i a v mat a i + X]i^j c « a i = 0- Then 
ijtj c i( a i\ r 'i) - (0|0). This is a contradiction since the set {r x - (a\\r[) } . . . , rj - 
(a{\r'j), . . . ,r n = (a™\r' n )} is linearly independent. Thus z\ = a\. Therefore, the matrix G 3 is 
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equivalent to the original matrix G 2 after permuting rows and columns of G 3 . This completes 
the proof. ■ 

Corollary VI.7. Let C be a double circulant CIS [2n,n] code whose generator matrix is of the 
form G = (I\A), where A is an invertible circulant matrix whose first row n has odd weight. 
Then the matrix G\ below generates a CIS code with systematic partition. 



/ 1 


0...0 


e 









1 






I 




A 


\o 




1 


J 



where e = if n is odd and e = 1 otherwise. 

Proof. This is the extension of (I\A) using Proposition IVI.4I where x and y are all one vectors, 
x is the sum of all rows of A, and z = e. ■ 

Remark VI.8. Proposition IVI.6I implies that one can construct all [2n +2,n + 1] CIS codes 
with systematic partition from the set of all [2n, n) CIS codes with systematic partition, many of 
which may be equivalent via column permutations. Here is a natural question. Given a complete 
list of inequivalent [2n, n] CIS codes with systematic partition, do we always construct all 
[2n + 2, n + 1] CIS codes with systematic partition using Proposition IVI.4P This may be so in 
most cases but it may not be true for some cases. Below is a reason. 

Let Ci (i = 1, 2) be a [2n, n] CIS code with generator matrix (I\Ai), where A{ is invertible. 
Suppose C\ is equivalent to C 2 under some 2n-column permutation (possibly interchanging 
some columns of the left half coordinates of C\ with some columns in the right half). Let D; 
(i = 1, 2) be the set of all CIS codes built from (I\Ai) by Proposition |VI.4[ Then it may not be 
true that Di is equivalent to D 2 , that is, for any C 3 G D 1; there exists C 4 G D 2 such that C 3 
is equivalent to C4 under some 2n + 2-column permutation, and vice versa. This is because the 
equivalence of C\ and C2 is via a permutation on 2n columns but Proposition IVI.4I is concerned 
about the right half of the (n + 1) x {2n + 2) matrix in the Equation (OQ). Therefore, given a 
complete list of inequivalent CIS codes of length 2n all of which have systematic partitions, the 
set of the CIS codes of length 2n + 2 constructed from Proposition IVI.4I does not necessarily 
give a complete list of inequivalent CIS codes of length 2n + 2 all of which have systematic 
partitions. In fact, F. Freibert has informed us that a certain set of the 27 inequivalent [8, 4] CIS 
codes with systematic partition produce only 194 [10, 5] CIS codes with systematic partition 
by Proposition IVI.41 although there are exactly 195 inequivalent CIS codes of length 10 (See 
Proposition IVI.12D . 

In what follows, we give a counting formula similar to a mass formula. This is useful in 
determining whether a list of inequivalent CIS codes is complete. Recall from Sec. IVI-AI that 
g n denotes the cardinality of GL(n,2). 

Proposition VI.9. Let n > 2. Let C be the set of all [2n, n] CIS codes and let S2 n act on C as 
column permutations of the codes in C. Let C\, . . . , C s be representatives from every equivalence 
class of C under the action of S 2 n- Let C sys be the set of all [2n,n] CIS codes with generator 
matrix {I n \A) with A invertible. Suppose that each Ci G C sys (1 < i < s). Then we have 
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s 



g n = Y,\° rb ^{C j )^C 



sys 1 ; 



(2) 



where Orbs 2n (Cj) denotes the orbit of Cj under S 2n . 

Proof. Let A G GL(n,2). Then each A gives a unique [2n, n] CIS code with generator matrix 
(I\A). Therefore g n = \C sys \- We also note that Ovb S2n (Ci) fl C sys and Orbs 2n (Cj) D C sys are 
disjoint whenever i ^ j. Therefore it is enough to show that each CIS code Ca with generator 
matrix (I\A) belongs to Orbs 2n (Cj) fl C sys for a unique j. Since {Ci, . . . , C s } is a set of 
representatives of all CIS codes, Ca belongs to a unique orbit Orbs 2n (Cj) for some j. Clearly 
Ca is in C sys by definition. Therefore Ca belongs to a unique Orbs 2n (Cj) fl C sys as desired. ■ 

C. Classification of short CIS codes 

We classify all CIS codes of lengths up to 12 up to equivalence. We successively apply 
Proposition IVI.4I from the repetition code of length 2 to obtain lists of inequivalent CIS codes 
of lengths 4, 6, 8, 10, and 12. For lengths up to 10, we have checked directly that these lists 
satisfy Equation ©. For length 12, checking directly that our list satisfies Equation © takes 
too long. So by inventing equivalence classes among matrices of GF(n,2), F. Freibert [7] has 
confirmed that our list of inequivalent CIS codes of length 12 is complete. 

It is easy to see that any CIS code has minimum distance > 2. 

• 2n = 2. It is clear that there is a unique CIS code of length 2, the repetition code. 

• 2n = 4. Applying Proposition IVI.4I to the repetition code of length 2, we show that there 
are exactly two CIS codes of length 4. Their generator matrices are (J|A 2 ,i) and (I\A 2i2 ), 



• 2n = 6. Using A 2ii , we have exactly six CIS codes of length 6, one of which is an optimal 
code of minimum distance 3. Similarly using A 2l 2, we have exactly five CIS codes of length 
6. But these latter codes are equivalent to some of the former codes. Generator matrices of 
the form (I\A 3ti ) (1 < i < 6) are given below. Only A 3ti are shown in order. 

/100\ /100\ /100\ /010\ / 1 1 1 \ / 1 1 1 \ 
1 0,1 1 0,1 1 0,1 1 0,0 1 0,1 1 

\o o i j \ooi/ yioi/ \ioiy \ooi/ \ioiy 

Hence we have the following. 

Proposition VI. 10. There are exactly six CIS codes of length 6. Only one code has d = 3 
and the rest have d = 2. 

• 2n = 8. From each of (I\A 3ii ) (1 < i < 6) we have many CIS codes of length 8 and thus 
consider the equivalence among them. We have the following. 

Proposition VI.11. There are exactly 27 CIS codes of length 8. Only one code has d = 4, 
three have d = 3, and the rest have d = 2. 

• 2n = 10. In a similar manner, we show the following. 



where 
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Proposition VI.12. There are exactly 195 CIS codes of length 10. Four codes have d = 4, 
thirty five codes have d = 3, and the rest have d = 2. 
• 2n = 12. Furthermore, using the 195 CIS codes of length 10, we have classified CIS codes 
of length 12. 

Proposition VI.13. There are exactly 2705 CIS codes of length 12. More precisely, exactly 
41 codes have d = 41, 565 codes have d = 3, and the rest have d = 2. 
We summarize our classification in Table HI The ith column of the table (i = 2,3,4) represents 
the number of CIS codes with d = i and the parenthesis gives the number of CIS codes in the 
order of sd, non-sd fsd, and non-fsd. The last column denotes the total number of CIS codes 
of the corresponding length. The actual generator matrices of lengths 8, 10, 12 will be posted 

in ma. 

TABLE I 

Classification of all CIS codes of lengths up to 12 in the order of sd, non-sd fsd, and non-fsd 



2n 


d= 2 


d= 3 


d= 4 


Total # 


2 


1 (1+0+0) 






1 


4 


2 (1+1+0) 






2 


6 


5 (1+2+2) 


1 (0+1+0) 




6 


8 


22 (1+9+12) 


4 (0+2+2) 


1 (1+0+0) 


27 


10 


156 (2+40+114) 


35 (0+9+26) 


4 (0+2+2) 


195 


12 


2099 (2+318+1779) 


565 (0+87+478) 


41 (1+7+33) 


2705 



VII. Long CIS codes 

In this section we show that there are long CIS codes satisfying the VG bound for rate 
one-half codes,that is with relative distance > H~ 1 (l/2) m 0.11 . We do not use the fact that 
self-dual codes are CIS. There are polynomial-time constructible binary self-dual codes with 
relative distance w 0.02 E4l p.34, Remark 1]. We begin by a well-known fact ll20l p.399]. 

2 

Lemma VII.l. The number of invertible n by n matrices is ~ c2 n , with c ~ 0.29. 

Denote by B(n, d) the number of invertible matrices A such that d columns or less of (/, A) 
are linearly dependent. A crude upper bound on this function can be derived as follows. 

Lemma VII.2. The quantity B(n,d) is < M(n,d) where 

j=2 t=l V / V / 

Proof. Let j be the size of the linearly dependent family of column vectors of (I, A), with 
j — t columns of / and t columns of A. Choose one column amongst t to be obtained as linear 
combination of j — 1 others. Neglecting the invertibility of A we have n — 1 columns of A to 
choose freely. ■ 

Denote by H(x) = —x\og 2 x — (1 — x) log 2 (l — x) the binary entropy function EDI p.308]. 
Lemma VII.3. The quantity M(n, d) is dominated by 2 n2 ~ n 2 2nH ^ when d ~ 25n with < 

<y<i. 
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Proof. We evaluate the inner sum in M(n, d) by the Chu-Vandermonde identity 



3 J ^WU-i 



Then, the outer sum 



,=0 v ^ 

is evaluated by standard entropic estimates for binomials [20, p. 310]. Note that t < n, a sub- 
exponential quantity. ■ 

Proposition VII.4. For each 5 such that H(5) < 0.5 there are long CIS codes of relative 
distance 5. 

Proof. Consider (/, A) as the parity check matrix of the CIS code and combine Lemmas 
IVII.1IVII.3IVII.2I to ensure that, asymptotically, \GL(n, 2)| >> B(n,d) showing the existence 
of a CIS code of distance > d, for n large enough. ■ 

VIII. Conclusion and Open Problems 

In this article, we have introduced a new class of rate one-half binary codes: CIS codes. 
In length 2n these codes are, when in systematic form, in one-to-one correspondence with 
linear bijective permutations in n variables. More generally, bijective permutations correspond 
to a certain class of systematic codes. The graph correlation immunity of such permutations is 
exactly the dual distance of the attached code. Free Z 4 codes of rate one-half can produce such 
codes by taking binary images. It would be a worthwhile task to create a database of Z4 codes 
in website form on the model of ll28l . There should be some good rate one-half free Z 4 -codes 
in the lengths 40 to 80. 

We have studied the minimum distances of linear CIS codes up to length 130 and we have 
found that it is possible to construct CIS codes as good as the best known minimum distance of 
rate one-half codes, and equal to the best possible distance of these codes up to length 36. Using 
Table HI we see that the first length when there is an optimal CIS code that is not self-dual is 4, 
and that the first length when an optimal CIS code cannot be self-dual is 6. The first length when 
an optimal CIS code is not a formally self-dual code is 20. Thus this new class of codes is richer 
than both self-dual, and formally self-dual codes. While invariant theory is not available to study 
these codes, a mass formula analogue is Prop. VI.9. We proved that up to length 130, there exist 
CIS codes with the best known parameters and we also proved that some optimal codes may 
not be CIS (for instance in length 34), it hence asks the question whether it is possible to find 
parameters for which CIS codes have a minimum distance strictly lower than the best linear 
codes? More generally, does the CIS property entails an upper bound on the minimum distance? 

Finally, it is worth extending the definition of CIS codes to other fields than F 2 , and also to 
rings. One motivation might be the growing field of Generalized Boolean functions, that is with 
ranges other than F 2 . Another motivation like in §3 might be to obtain binary CIS codes by 
some alphabet changing construction. 
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